Modern cyberattacks rarely leave digital footprints in a single isolated location. A cybercriminal may deploy a fraudulent phone call or phishing message to deceive a victim, execute harmful code, deliver a malicious file, and maintain covert communications with a remote server. Because these crucial clues remain scattered across disparate computers, application logs, system memory, and network traffic records, piecing them together poses a significant challenge for digital forensic investigators. Addressing this complexity, research led by Mr Rijvan Beg from SRM University-AP introduces an artificial intelligence system that synthesises these fragmented digital clues. Acting much like a digital detective, the framework connects related evidence, reconstructs complete attack sequences, estimates missing event stages, and evaluates potential future malware variations while clearly distinguishing established observations from hypothetical predictions to assist cybersecurity professionals.

In the paper “Multimodal Generative Cyber Forensics Network for Unified Malware Intelligence Synthesis through Temporal Evidence Alignment, Neuro-Symbolic Hypergraph Reasoning and Cognitive Threat Attributions”, published in Scientific Reports, a Q1 journal with an impact factor of 4.9 published by Nature Publishing Group, Mr Rijvan Beg, Assistant Professor in the Department of Computer Science and Engineering at SRM University-AP, presented this framework alongside collaborators Dr R K Pateriya and Dr Deepak Singh Tomar from Maulana Azad National Institute of Technology (MANIT), Bhopal, as well as Dr Ghanshyam Raghuwanshi and Dr Surendra Solanki from Manipal University Jaipur.

The research presents a Multimodal Generative Cyber Forensics Network (MGCFN), an artificial intelligence-based framework designed to improve malware investigation by integrating different forms of digital evidence, including phishing audio, malicious text and scripts, executable files, and network traffic. Unlike conventional approaches that analyse these sources separately, the proposed framework combines temporal evidence alignment, neuro-symbolic hypergraph reasoning, evidence-constrained attack-sequence reconstruction, counterfactual malware-evolution simulation, and confidence-aware threat attribution. The framework was evaluated using established malware and network datasets, including VirusShare, CIC-MalMem-2022, the Android Malware Corpus, and the Malware Traffic Repository, along with an integrated controlled multimodal benchmark. The reported results achieved 99.26% classification accuracy, a 99.20% F1-score, and a 99.66% area under the ROC curve (AUC). The research aims to support more comprehensive, traceable, and uncertainty-aware cyber-forensic investigations while distinguishing observed evidence from reconstructed attack stages and simulated future scenarios.

The practical implications of this framework extend across cybercrime investigations, incident response, malware classification, attack reconstruction, and digital forensic reporting, empowering security teams to trace threat sequences and safeguard institutions against sophisticated cyber threats. By supporting traceable, evidence-oriented reporting, the system enhances organisational cybersecurity while ensuring human investigators remain central to decision-making. Looking to the future, research efforts will focus on validating the system against naturally linked real-world cyber incidents, enhancing zero-day malware detection, optimising model efficiency for resource-constrained forensic environments, and advancing privacy-preserving, human-in-the-loop digital forensic workflows.

Read the full article here